IT training squid proxy configuration guide

SQUID PROXY CONFIGURATION GUIDE Installation, configuration and Management guide ABSTRACT This “Do it yourself” guide is intended for any computer users who would like to improve their internet experience by creating local copies of frequently visited sites making them load faster when requested in future using Squid web cache “Sharing copies of software is everybody's natural right and nobody should ever take that away”, says Richard Stallman, Australia Bill Gates once said, “the use of unauthorized copies of windows will get users addicted and eventually Microsoft would find a way to charge them.” INTRODUCTION The need for the set up, configuration and deployment of a proxy server emanates from the need to improve the internet experience-getting better internet speeds or rather response times when requesting initially accessed web pages without necessary paying more to your ISP This can be achieved by setting up a proxy server within your local network which can cache previously accessed pages making them load faster when requested in future A proxy server receives requests from clients, searches within itself for the resource requested and if unavailable, the requests are forwarded to other servers on the internet The responses are then cached prior to sending responses to client connected to it via a LAN The server may also have limited content filtering features that may allow one to limit access to certain resources perhaps totally or only grant access based on time, user of the system among other criteria chosen during the design of the content filter's access control lists Proxy servers are not only meant to be used by ISP's, large companies, research institutions and government institutions but may also be used in homes for instance to control what the children can access over the internet and the amount of time they can be on line on a given day besides accomplishing the improved speed satisfaction REQUIREMENTS FOR SETTING UP SQUID PROXY SERVER Normally, a properly configured squid proxy server would not require high performance hardware system to run efficiently However, the following portion below has to be put into consideration Squid proxy server requires a considerably large RAM; at least 512MB for a small organization Low memory will significantly result in reduction in speed The other major consideration is disks The faster the disk read and write speeds the faster squid will operate As a result, SCSI disks are normally preferred just because of the speed The other advantage of SCSI is that it can access seven different drives allowing for multiple reads and writes without a slowdown in access SATA disks can however, be used as they considerably fast speeds, are cheap and are more readily available in larger sizes ATA may be a poor option more so if they are on the same channel, as the system has to wait simply because only one disk can be accessed at a time Choosing a suitable Operating System Assuming you are working on a shoe-string budget, we shall opt for “your freedom first”, as the controversial Richard Stallman puts it, stability, cost and the extent of support desired and thus, an open source solution that is more secure and under which squid runs more efficiently than some proprietary solutions available in the market, no malice intended whatsoever We still need the proprietary software There are a plethora of free and Open Source Linux distributions to choose from The following are the factors used to select CentOS(Community enterprise Operating System) as the distribution of choice: It is stable It is free It is readily available for download It is packaged with most applications required for the implementation of a proxy server It is a actively supported by its large community of users who mostly use it for server applications The Linux Community will always have security patches available even within an hour of discovering security vulnerabilities Faster than what you get for the proprietary software as they normally have smaller teams working on their source code Choosing a Proxy server application The proxy server of choice is Squid web proxy cache as it can both act as web cache and has minimal content-filtering features Besides which it is free, well documented, rich in features and readily available for download Other proxy servers that can be implemented on Linux are such as Oops, 3proxy which is freeware and ipcorp which is still new in the market and not much information is presently available on the same Configuring proxy server The following section describes the most frequently used options when configuring a squid proxy server and as a result does not cover all the features that squid offers as this is beyond the scope of this guide This is probably going to be covered by someone else or probably is already covered NB: This document does not cover the installation process STEP I : Knowing your system It is necessary to know the Hardware architecture, Operating system and its release number, the application versions and the kernel number as some configurations may vary depending on any of the above features For instance, Squid version 2.6 and above configurations vary significantly that a person whose previously used versions lower than 2.5 would not consider negligible These information is necessary and should be put into consideration when seeking for answers in Linux forums, posting comments in blogs, mailing lists and other online communities Below is a description of how to obtain the above mentioned information: Operating System distribution and release The Linux distribution being used and its release can be retrieved prior to downloading of the disk images However, if the disks were downloaded by someone else or the system is already installed, one can normally obtain this information during installation and on start up of the installed system Hence, our system will run on CentOS release 5.2 (final) Hardware architecture This may be categorized using bus-width, processor type etc The most common architectures are: a) x86 - This represents 32-bit systems and may be written as i386, i586, i686 and so forth b) x86-64 - This representation shows that a system has a 64-bit bus size Checking if applications are installed and their versions This can be done on the terminal which can be accessed in the following manner Go to Applications > Accessories > Terminal to open gnome-terminal Alternatively, this can be accessed by pressing ALT+F2 to open the run application and typing in “gnome-terminal” followed by clicking on the Run button to run the terminal [admin@server ~]$ rpm -q squid squid-2.6.STABLE6-5.el5_1.3 [admin@server ~]$ The above command shows that squid version 2.6 revision is installed in release 5.2 of CentOS [admin@server ~]$ rpm -q iptables iptables-1.3.5-4.el5 [admin@server ~]$ iptables version packaged in CentOS release 5.2 is version 1.3.5 and will be used in redirecting requests from certain ports to the proxy server Kernel version One can tell the kernel version using the uname command on the gnome terminal with the -r argument as shown below to print the kernel version: [admin@server ~]$ uname -r 2.6.18-92.el5 [admin@server ~]$ Interpretation of the output above is the kernel in use is release 2.6.18 minor revision 92 The minor revisions are specific or relevant to a given Linux distribution while the major version number is standard across the Linux distributions It is in good practice that you upgrade the base operating system installed prior to commencing the configuration process This will allow both the base system and the configurations to be updated unlike attempting to upgrade an already configured system which would retain the configuration files STEP II: Basic Configurations This section aims to get squid proxy to start successfully The first and critical step in configuring squid proxy server is confirming the existence of a default configuration file which is normally in the /etc/squid/ directory and backing it up These can be done as shown in the following steps [admin@server ~]$ cd /etc/squid/ [admin@server squid]$ file squid.conf squid.conf: ASCII English text [admin@server squid]$ cp squid.conf squid.conf.default [admin@server squid]$ Interpretation: The first instruction changes the current directory to the directory where the squid configuration sits After which the the next instruction checks the type of file squid.conf (default configuration file) is Lastly, the default configuration file is backed up to squid.conf.default which can be used to restore the default configuration in the event of a failure The default squid configuration file looks as shown below when opened from gedit, a text editor The lines that commence with the hash(#) symbol are comments hence, are not read by the squid daemon The comments are include instructions and examples of how to make configurations Check that the port to which squid should listen for is configured The default is port 3128 Whenever the redirecting application for instance the router or firewalling application sits on the same server as the proxy then you only need to change the destination port to the port the proxy is listening on This makes squid listen on a port rather than a socket as would be the case when we are redirecting requests from an external system This is done as shown in the line below: Snippet from /etc/squid/squid.conf http_port 3128 Snippet from /etc/squid/squid.conf Ensure that the cache_dir is set to an exiting location .Snippet from /etc/squid/squid.conf cache_dir ufs /var/sqool/squid 100 16 256 Snippet from /etc/squid/squid.conf where, 100 denotes a cache size of 100MB For configuration purposes, let the default http_access should be allowed to deny all connections this line by default appears as shown below: Snippet from /etc/squid/squid.conf #Default: # http_access deny all Snippet from /etc/squid/squid.conf Select the “Network” tab Select click the “Settings ” button Select the “Manual proxy configuration” radio button Enter proxy IP address and its ports number The resulting image should be as shown below: The proxy setting for the squid server and the port that squid listens for connection are 192.168.0.101 and 3128 respectively Restart the configuration to effect the new configuration Once the above configuration is done and squid is already running, an attempt to access a page on the Internet via your browser would result in the following page Below, is the default error page which can be tailored to suite the tastes of the organization such as shown later in this guide The error page displays the URL of the page that the client attempted to access, the email address of the person to be contacted in case access is denied erroneously, date and time of denial and the name of the server that hosts the squid process among others This error page may be modified to suit the preferences of a given organization or network in general STEP III: Advanced Configurations Since we've confirmed that squid is running with the default ACL restriction (http_access deny all) enforced, we shall proceed to the next stage of designing, testing and enforcing custom ACLs that satisfy the network needs for squid proxy STEP I: Things to remember The ACL rule set are enforced / read from top to bottom This means that if two rules contradict the first of the contradicting rules shall be enforced In the example below, instruction number holds true thus nobody shall be able to chat using google talk REMEMBER: The numbers are used for illustration and not exist in the actual file .Snippet from /etc/squid/squid.conf acl google-talk port 5223 #XMPP over SSL http_access accept google-talk http_access deny google-talk Snippet from /etc/squid/squid.conf You can join ACLs to form a single rule For example, the below ruleset implies deny google talk access between Monday and Friday as from !0:00 a.m To 2:00 p.m Snippet from /etc/squid/squid.conf acl google-talk port 5223 #XMPP over SSL acl working-hours time M T W H F 10:00-14:00 http_access deny google-talk working-hours Snippet from /etc/squid/squid.conf Do not give ambiguity a chance For instance, If a rule may stipulates, “allow clients on the MYNET network to access the proxy server” This is a valid rule and is not wrong by any standards but remember it doesn't specify what happens to those not in the MYNET network thus, those not in the MYNET network may still be able to access the proxy server This ambiguity can be catered for by creating a complimenting pair of rules E.g http_access allow MYNET http_access deny !MYNET Design and implementation of ACLs Write the rules in plain English Convert them to ACLs using the supported squid acl types Concatenate ACLs where necessary to form a common rule For instance, Only MYNET would use proxy MYNET proxy clients should not access the following sites: www.facebook.com, www.myspace.com These would be converted to ACLs as follows: acl MYNETWORK src 192.168.0.0/24 acl unwanted-sites url_regex -i “/acl/unwanted-sites.txt” where, the file unwanted-sites.acl would contain a list of the sites each in a new line E.g As shown below: www.facebook.com www.myspace.com Finally, enforce the desired rules using the ACLs above created http_access allow MYNETWORK http_access deny !MYNETWORK http_access deny unwanted-sites For list type ACLs that require maintenance or updating from time to time, it is advisable to create them in a text file to avoid making erroneous alterations during the process of updating ACLs These ACLs can the stored in a specified order to install order in our case, “/etc/squid/acl/” The ACLs that have been created on my squid proxy server are as shown below: These ACLS are used to create the rules shown below: Snippet from /etc/squid/squid.conf # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS http_access deny porn http_access deny downloads http_access allow social lunchtime http_access deny social !lunchtime http_access allow non_porn http_access allow MYNET http_access deny !MYNET Snippet from /etc/squid/squid.conf A list of the resource to be filtered may appear as a regular ASCII text file as this shown below: [root@server admin]# cat /etc/squid/acl/social-sites.acl facebook.com hi5.com myspace.com [root@server admin]# Squid ACLs For the sake of order, we shall create a folder called acl inside the squid directory where we shall store our ACLs This we as follows: [root@server admin]# cd /etc/squid/ [root@server squid]# mkdir acl [root@server squid]# The ACLs used in this server can be categories into two: a) Inline Acls b) External ACLs a) Inline ACLs These are the ACLs defined within the file squid.conf some of them inlude: acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl MYNET src 192.168.0.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl working-hours time M T W T F 09:00-16:00 acl lunchtime time M T W T F 12:30-13:50 acl multimedia urlpath_regex -i \.(mp3|avi|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|afx|divx|m3u|viv|vivo| vo|flv|swf)$ b) External ACLs These are ACL that are defined in external files for our scenario we store them in the directory, /etc/squid/acl Squid can have ACLs of any extension as long as they are flat files Streaming Streaming of multimedia has a tendency to grab large volumes of internet traffic thus, would result in slowed internet speeds Multimedia are way larger and thus would require more bandwidth to the organization Since streaming wouldn't add value to the organization, blocking streaming would break no bone acl streaming req_mime_type -i application/octet-stream acl streaming req_mime_type -i application/x-mplayer2 acl streaming req_mime_type -i video/x-ms-asf acl streaming req_mime_type -i audio/midi acl streaming req_mime_type -i audio/mpeg acl streaming req_mime_type -i video/x-msvideo acl streaming req_mime_type -i video/x-flv Streaming is blocked using mime-types as shown above however, and is blocked using http_access and http_reply_access as opposed to http request and this is shown below http_access deny streaming http_reply_access deny streaming Converting Squid to work in transparent caching mode STEP I: Configure Squid to listen for transparent connections As of Squid version 2.6 the squid service can be made to work on transparent mode by simply appending the word transparent beside the proxy port number as shown below: Snippet from /etc/squid/squid.conf http_port 3128 transparent Snippet from /etc/squid/squid.conf However, this is not all We also need to configure iptables or a routes to redirect requests to the squid server without making it necessary for one to make proxy configurations on the server clients This makes it difficult for the clients to circumvent the proxy server by removing proxy configurations from the web browser they are using STEP II: Configure iptables to support Squid Iptables is a RedHat Linux firewall application that could be used to redirect requests to the proxy server This can be done at the command line as follows: [root@server admin]# iptables -F [root@server admin]# iptables -t nat -F [root@server admin]# iptables -t mangle -F [root@server admin]# iptables -A INPUT -i eth0 -j ACCEPT [root@server admin]# iptables -t nat -A PREROUTING -i ppp0 -p tcp dport 80 -j REDIRECT toport 3128 [root@server admin]# iptables table nat append POSTROUTING out-interface ppp0 -j MASQUERADE [root@server admin]# service iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ] In the configuration above, eth0 is the Network interface Card connected to the LAN whereas PPP0 is the dial up modem that the squid server uses to connect to the internet This configuration only redirects port 80 to the proxy server however, it should redirect all ports that should be filtered to the proxy server or the squid service to be precise The SSL port 443 and other secure communications should not be redirected to squid as the SSL key would be altered and as a result no communication would occur as the host and client attempting to communicate would close session as they would detect this as a “man in the middle attack” This is simply because squid does not support tunneling Restoring iptables script One would be required to reload the configurations each time on rebooting the server using the following command [root@server admin]# iptables-restore